CodeVetter · Repo Unpack · Risk map
nuxt/nuxt
The following items are sensitive source boundaries and explicit limitations, not confirmed vulnerabilities. Executable configuration, remote layers, dependency installation, development HTTP handlers, and request-header forwarding deserve focused review when changed. Hydration serialization and streaming response commitment impose correctness constraints that cross package boundaries. The strongest observed testing limits are configured exclusions, a disabled benchmark job, and a documented development CSS fixme.
- Configuration is executable input: importConfigFile uses native dynamic import and may retry through Jiti, while c12 enables global rc loading by default and accepts remote extends sources.
- Dependency recovery can mutate a consumer project and spawn a package-manager process: ensureDependencyInstalled prompts outside CI, permits StackBlitz-specific auto-install behavior, and runCommand invokes tinyexec with the detected command and arguments.
- The Vite builder includes workspaceDir, module directories, layer roots, and discovered component/plugin/middleware/layout directories in its allowDirs calculation, so development file access must be reviewed beyond the application's immediate root.
- Request-scoped fetch forwards incoming headers, excluding a defined denylist, only when the underlying request is a string beginning with '/'; the wrapper sits below user hooks. useFetch separately rejects protocol-relative requests without baseURL.
- Public/app runtime config and serializable async-data results reach browser-visible scripts or payload JSON; private values placed into those objects would therefore cross the client boundary. (inferred)
- deriveSecret fails with status 500 when appSecret is unset or shorter than 32 characters and derives purpose-specific HKDF-SHA256 material; session sealing depends on that derivation unless an explicit password is supplied.
- Session data is sealed into the cookie and limited to 4096 serialized characters; default HttpOnly, Secure, SameSite=Lax, and root-path settings can be overridden through config.cookie.
- getRequestIP trusts the first x-forwarded-for value only when explicitly enabled. Applications using that option for access decisions depend on their proxy's header handling; this is an integration hypothesis, not a demonstrated exploit. (inferred)
- The optional Chrome DevTools workspace endpoint exposes an absolute root and stable UUID, but its implementation requires both a loopback peer and isLocalDevRequest; allowedHosts:true changes the host policy input.
- Streaming commits response status before delayed page work completes: tests explicitly expect a mid-stream error to retain HTTP 200 and a late 418 to be dropped, while buffered rendering applies the late status.
- Compatibility code is an active transition surface: nitroLegacy has independent imports/h3/specifier/runtimeConfig/config toggles, detects migrated Nitro v3 specifiers, and states that the compatibility layer is intended for removal in Nuxt 6.
- Source-recorded verification gaps include disabled benchmark CI, excluded Rspack chunk-error browser tests, excluded mutation suites under Nitro-Vite, and a fixme for dev streaming CSS; these do not establish failures in other configurations.
- Privileged pull_request_target workflows warn against adding checkout and currently operate on PR metadata; ecosystem CI additionally checks triage permission and whether the PR repository was pushed after the trigger comment before dispatching a captured SHA.